2

I have a multi module maven project which I'd like to create an SBOM on each module and get an Aggregated BOM on the root-folder with cyclonedx-maven-plugin.

When I execute the following command :

mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.2:makeAggregateBom -DoutputReactorProjects=true -DoutputFormat=xml -B

I have an Aggregated BOM on the root target folder and also BOM inside each module. That's the expected behavior. In some case, if it's needed, I put the property "outputReactorProjects" to false to only get the aggregated bom on the root target folder.

Since 2.7.4, the property "outputReactorProjects" has no effect and I never get the BOM inside the module if I use the "makeAggregateBom" goal. Just like if the property is set to false ( https://cyclonedx.github.io/cyclonedx-maven-plugin/makeAggregateBom-mojo.html#outputReactorProjects )

Following documenation we can still produced an Aggregated BOM and a BOM inside the sub-module : "makeAggregateBom: creates an aggregate BOM at build root (with dependencies from the whole multi-modules build), and eventually a BOM for each module"

Case reproduced with Maven 3.8.5 and Maven 3.9.0, Plugin version 2.7.4, 2.7.5 and 2.7.9.

I have tried these commands :

mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.2:makeAggregateBom -DoutputReactorProjects=true -DoutputFormat=xml -B

---> Root SBOM and Sub-Modules

mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.2:makeAggregateBom -DoutputReactorProjects=false -DoutputFormat=xml -B

---> Root SBOM only

mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.4:makeAggregateBom -DoutputReactorProjects=true -DoutputFormat=xml -B

---> Root SBOM only

mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.4:makeAggregateBom -DoutputReactorProjects=false -DoutputFormat=xml -B

---> Root SBOM only

mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.9:makeAggregateBom -DoutputReactorProjects=true -DoutputFormat=xml -B

---> Root SBOM only

mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.9:makeAggregateBom -DoutputReactorProjects=false -DoutputFormat=xml -B

Improve this question
1
Related questions
2
Maven 2 - 'mvn test' does not find internal project plugin dependency
1
Execute flyway:migrate using maven on a sub module
0
Maven execute only one plugin among two based on a property
Load 4 more related questions Show fewer related questions

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.